CVE-2026-64510

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ACPI NFIT core where improper error cleanup in the acpi nfit init() function can lead to a use-after-free condition. If acpi nfit init() fails after adding an acpi desc object to the acpi descs list, the object is not removed, leaving a dangling pointer. Subsequently, an ACPI Machine Check Exception (MCE) triggers the nfit handle mce() function, which iterates over the acpi descs list and accesses the freed memory. Additionally, if acpi nfit probe() returns 0 without allocating the acpi desc object, the object may be allocated by acpi nfit update notify() and initialized via acpi nfit init(). In this scenario, the acpi nfit shutdown() action is not registered, and the acpi desc object remains in the list after driver removal, again leading to a use-after-free during an ACPI MCE.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.